From c9bf7b66234eafc07db6fda9cfc26e0c151e417e Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 19 Apr 2015 11:57:05 +0300 Subject: [PATCH] Fix a memory leak on mesh_attr_text() error path Should there not be enough room in the output buffer, the bss_basic_rate_set line would not be printed. This error case was handled otherwise, but the temporary memory allocation for building the information was not freed. Signed-off-by: Jouni Malinen --- wpa_supplicant/mesh.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/wpa_supplicant/mesh.c b/wpa_supplicant/mesh.c index 33b4af38f..ca012e253 100644 --- a/wpa_supplicant/mesh.c +++ b/wpa_supplicant/mesh.c @@ -453,22 +453,23 @@ static int mesh_attr_text(const u8 *ies, size_t ies_len, char *buf, char *end) ret = os_snprintf(pos, end - pos, "bss_basic_rate_set=%d", bss_basic_rate_set[0]); if (os_snprintf_error(end - pos, ret)) - return pos - buf; + goto fail; pos += ret; for (i = 1; i < bss_basic_rate_set_len; i++) { ret = os_snprintf(pos, end - pos, " %d", bss_basic_rate_set[i]); if (os_snprintf_error(end - pos, ret)) - return pos - buf; + goto fail; pos += ret; } ret = os_snprintf(pos, end - pos, "\n"); if (os_snprintf_error(end - pos, ret)) - return pos - buf; + goto fail; pos += ret; } +fail: os_free(bss_basic_rate_set); return pos - buf;